CVE-2025-58445
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-06

Last updated on: 2025-09-10

Assigner: GitHub, Inc.

Description
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed version information through its /status endpoint. This information disclosure could allow attackers to identify and target known vulnerabilities associated with the specific versions, potentially compromising the service's security posture. This issue does not currently have a fix.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-06
Last Modified
2025-09-10
Generated
2026-06-16
AI Q&A
2025-09-06
EPSS Evaluated
2026-06-14
NVD
CVE-2025-58445
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
runatlantis atlantis to 0.35.1 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-NVD-CWE-noinfo
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an information disclosure issue in the Atlantis application where the /status API endpoint publicly exposes detailed version and build information without requiring authentication. This endpoint reveals sensitive metadata such as software version, build details, dependencies, and system configurations. Attackers can use this information to identify specific versions and target known vulnerabilities associated with those versions, potentially compromising the system. [1]

Impact Analysis

The vulnerability can allow attackers to gather detailed version information about the Atlantis service, which they can cross-reference with public vulnerability databases to find known exploits. This can lead to targeted attacks against the system, increasing the risk of compromise if critical vulnerabilities exist in the exposed version. Although the base severity is low, the risk can be higher depending on the disclosed version's vulnerabilities. [1]

Compliance Impact

The exposure of sensitive system information through the /status endpoint violates security best practices outlined in standards such as OWASP Top 10 and NIST SP 800-53, which recommend minimizing publicly accessible sensitive information. While the text does not explicitly mention GDPR or HIPAA, such information disclosure could negatively impact compliance by increasing the risk of unauthorized access and potential data breaches. [1]

Detection Guidance

You can detect this vulnerability by issuing an unauthenticated GET request to the /status endpoint of your Atlantis service. For example, using the command: curl http://<atlantis-server>/status. If the response includes detailed version, build, dependency, or system configuration information, your system is vulnerable to this information disclosure. [1]

Mitigation Strategies

Immediate mitigation steps include restricting access to the /status endpoint so that it is not publicly accessible, or limiting the information it discloses to internal and secured channels only. Since no fix is currently available, controlling access to this endpoint reduces the risk of attackers obtaining sensitive version information and targeting known vulnerabilities. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-58445. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart